Learning Malware Analysis

9.3.6 Scanning Memory (scasx)

The scasb instruction is used to search (or scan) for the presence or absence of a byte value in a sequence of bytes. The byte to search for is placed in the al register, and the memory address (buffer) is placed in the edi register. The scasb instruction is mostly used with the repne instruction (repne scasb), with ecx set to the buffer length; this iterates through each byte until it finds the specified byte in the al register, or until ecx becomes 0.